- ATM compliance for independent operators covers ADA accessibility, EMV chip acceptance, PCI PIN security, and the Regulation E surcharge notice.
- Under the 2010 ADA Standards, unobstructed reach to operable parts is 48 inches maximum and 15 inches minimum, with a 30 by 48 inch clear floor space, speech output, and a tactile keypad.
- EMV liability for ATM counterfeit fraud shifted in October 2016 (Mastercard) and October 2017 (Visa).
- PCI required TR-31 key blocks for ATM key transfer starting January 1, 2025; non-compliant machines can be refused by processors.
- The fee must be shown on screen or paper before the customer is committed; the physical fee sticker requirement ended in 2012.
ATM compliance for an independent operator rests on four sets of rules: ADA accessibility (reach height, talking ATM, tactile keypad), EMV chip acceptance, PCI security for the PIN pad and encryption keys, and the federal surcharge disclosure under Regulation E. Current retail machines are built to meet most of it out of the box. Your job is to install them correctly, keep them current, and not buy old hardware that falls short.
Part of our complete guide: best cash flow businesses.
This is a practical overview, not legal advice. Rules change, processors and sponsor banks add their own requirements, and state and local laws vary. Where something is unclear, check with your processor and, for anything that affects your liability, a qualified attorney. We cite the primary source for each rule so you can read it yourself.
The compliance checklist at a glance
| Area | Source | What it means in practice | Mostly handled by |
|---|---|---|---|
| Accessibility | 2010 ADA Standards, sections 220 and 707 | Clear floor space, controls within reach, speech output, tactile keypad, Braille for starting speech mode | Machine design plus your installation |
| EMV chip | Card network rules (liability shift 2016–2017) | Chip reader in use, or you may bear counterfeit-card fraud losses | Machine and processor |
| PIN security | PCI PIN and PTS standards, TR-31 key blocks from 2025 | Approved encrypting PIN pad and software that supports current key formats | Machine, processor, key loading |
| Fee disclosure | EFTA and Regulation E, 12 CFR 1005.16 | On-screen or paper notice of the fee before the customer is committed | Terminal software you configure |
| Bank and network rules | Sponsor bank and ISO requirements | Business documents, source of vault cash, network signage and logos | You, through your processor |
| State and local | Varies by state and city | Possible notice filings, lighting or security rules, business licenses | You |
ADA accessibility: height, reach, and the talking ATM
The 2010 ADA Standards for Accessible Design govern ATMs through section 220 (scoping) and section 707 (technical requirements). Where ATMs are provided at a location, at least one of each type must comply. For a small operator with one machine at a bar, that means your one machine.
Clear floor space and reach
Section 707.2 requires a clear floor space complying with section 305, which is a 30 by 48 inch area so a wheelchair user can pull up. Operable parts must meet section 309, which points to the reach ranges in section 308: where reach is unobstructed, the highest operable part should be no more than 48 inches above the floor and the lowest no less than 15 inches, for both forward and side approaches. Obstructed reach (reaching over a counter or ledge) has tighter limits.
Here is where operators get into trouble. The machine meets the standard as designed, but it is installed on a platform, wedged behind a high-top table, or placed where a trash can blocks the approach. Before bolting down, measure the height of the card slot and keypad from the finished floor and keep the 30 by 48 inch space clear. Ask the venue not to park furniture there. Also check that the route to the machine is accessible; a step down to a back hallway can be its own problem.
Speech output, keypad, and Braille
Section 707.5 requires machines to be speech enabled so a person with a vision impairment can use every function independently, with speech delivered through a readily available mechanism such as an industry-standard headphone jack. Section 707.6 requires tactile controls: a telephone-style 12-key numeric layout with a distinct 5 key, and function keys marked with specified tactile symbols. Section 707.7 sets display visibility from 40 inches above the floor. Section 707.8 requires Braille instructions for starting speech mode, not full Braille menus. Section 707.4 requires the same degree of privacy for everyone.
Current retail models from Genmega, Hyosung, and Hantle are designed with voice guidance and ADA keypads. What you control is whether the audio actually works. Test the headphone jack with a pair of earbuds after installation and after any repair.
Picture the machines paying you while you sleep
That’s the real promise of vending — income that doesn’t cost you your time, and a life on your own terms. VendBuddy turns this guide into a step-by-step plan so you actually build it instead of just reading about it. Start free today.
Start building free →EMV: why a chip reader is non-negotiable
The card networks moved counterfeit-card fraud liability for ATM transactions to the party with the less secure technology: October 1, 2016 for Mastercard and October 1, 2017 for Visa. In practice, if a counterfeit magnetic-stripe copy of a chip card is used at your machine and your machine could not read chips, the fraud loss can land on you instead of the card issuer. Every current retail ATM ships with an EMV reader. The risk sits in older used machines. Some can be upgraded with a kit (dealers list kits for older models around $500); some cannot be upgraded economically. Our ATM buyer’s guide lists current models.
PCI: PIN pads, encryption keys, and TR-31
PCI security standards cover the encrypting PIN pad (EPP), the device that scrambles a customer’s PIN the instant it is typed. EPPs are approved to a PCI PTS version, and older approvals expire over time. Your processor sets the minimum they accept.
The big recent change is TR-31. PCI required the TR-31 key block format for transferring encryption keys to ATMs starting January 1, 2025. Machines whose EPP or software cannot support it can be refused by the host processor, which means the machine stops earning. If you are buying used, or buying an existing route, get the EPP model and firmware version for every terminal and ask the processor to confirm each one in writing.
The other side of buying a route is that somebody is always getting out. The marketplace is where operators post routes and machines for sale, and it is free to browse.
PCI also shapes routine habits: inspect the card slot and keypad for skimming overlays when you service the machine, keep keys and combinations restricted, and do not let anyone other than your trusted tech open the top housing. Some operators keep a short log of every service visit.
Surcharge disclosure under Regulation E
Federal law lets you charge a surcharge, but you must disclose it. Under 12 CFR 1005.16, an ATM operator that charges a fee must tell the customer that a fee will be imposed and how much it is, either on the screen or on paper, before the customer is committed to paying it. The fee can be charged only if the customer chooses to continue after seeing that notice. Congress removed the old requirement for a physical fee sticker on the machine in December 2012, and the CFPB updated Regulation E to match in 2013. The on-screen notice is still mandatory.
Your processor or dealer typically configures this screen when the terminal is programmed. Your job is to confirm the displayed amount matches the surcharge you set, especially after you change it. The size of the surcharge itself is a business decision; see how much to charge for an ATM surcharge. A small number of states have historically placed limits on ATM fees, so check with your processor about your state.
Sponsor bank, BSA, and state rules
Your processor’s sponsor bank is responsible for making sure the ISO follows network rules, and federal bank examiner guidance tells banks to understand where the cash in privately owned ATMs comes from. Expect to provide business documents and describe the source of your vault cash, such as business proceeds, a loan or credit line, or a bank account.
You may read online that every ATM owner must register with FinCEN as a money services business. FinCEN’s 2007 guidance says that a nonbank ATM owner offering only balance inquiries and cash withdrawals from customers’ bank accounts is not an MSB for BSA purposes. If you offer anything beyond that, including cryptocurrency, the answer changes. Confirm your own situation with your processor or counsel.
State rules vary. Illinois, for example, asks non-bank operators to file a notice of a terminal with the state within 60 days of establishing or acquiring it, and addresses lighting for ATMs and the areas used to reach them. Several other states have ATM security laws, some written mainly for financial institutions. Cities may require a business license. Search your state banking regulator’s site for "ATM" and ask your processor what they see other operators in your state doing.
An install-day routine
Here is an illustrative example, not a real operator. Priya is placing her second machine in a laundromat. Before bolting, she measures the keypad and card slot height from the floor, confirms a clear 30 by 48 inch space with the dryers’ carts moved elsewhere, and agrees with the owner in writing that the space stays clear. After the tech powers it on, she runs a test withdrawal, reads the fee screen to confirm the amount, plugs in earbuds to test the voice guidance, and photographs the setup for her records. It takes about twenty extra minutes and closes most of the easy compliance gaps.
Where compliance fits in the bigger picture
Compliance is the floor, not the business. The income still comes from a well-chosen venue. If you are still looking, VendBuddy lists laundromats, bars, convenience stores, and similar venues in any ZIP with the decision-maker’s contact, and credits come in one-time packs. For the other pieces, see how to choose an ATM processor and ATM business mistakes to avoid.
Frequently Asked Questions
What are the ADA requirements for an ATM machine?
The 2010 ADA Standards (sections 220 and 707) require, among other things, a 30 by 48 inch clear floor space, operable parts within reach range (48 inches maximum and 15 inches minimum where reach is unobstructed), speech output through a readily available mechanism such as a headphone jack, a telephone-style tactile keypad, and Braille instructions for starting speech mode. Current retail machines are designed to meet these; installation height and obstructions are what operators most often get wrong. This is general information, not legal advice.
Do I still need an ATM fee sticker on my machine?
Not under federal law. Congress removed the requirement for a posted fee notice on or at the ATM in December 2012, and Regulation E was updated in 2013. You still must show the fee amount on the screen or on paper before the customer is committed to paying it. Check with your processor about any state or network signage rules.
What happens if my ATM is not EMV compliant?
Since the card networks' liability shift for ATMs (October 2016 for Mastercard, October 2017 for Visa), an ATM that cannot read chip cards may bear the loss when a counterfeit card is used at it. Many processors also require current EMV and PIN pad hardware to keep the terminal online. Older machines may need an upgrade kit or replacement.
What is TR-31 and does it affect my ATM?
TR-31 is a key block format for securely transferring encryption keys to devices like ATM PIN pads. PCI required it for ATM key transfer starting January 1, 2025. If your machine's encrypting PIN pad or software cannot support it, your host processor may stop accepting its transactions. Ask your processor to confirm each terminal.
Do independent ATM owners have to register with FinCEN as a money services business?
FinCEN's 2007 guidance says a nonbank ATM owner that only provides balance inquiries and cash withdrawals from customers' bank accounts is not a money services business under the Bank Secrecy Act. Your sponsor bank will still perform due diligence and may ask about the source of your vault cash. Services beyond basic withdrawals can change the answer, so confirm with your processor or counsel.